Is it best practice to use a Deployment Server to deploy configurations to non-clustered search peers (indexers)?

[BlueSocket]

Dear All,

I have a Search Head and Two non-clustered indexers (search peers) and I am architecting the system to include a Deployment Server and several Forwarders.

I know that you must not use Deployment Server to deploy apps and configurations to clustered indexers (that is what the indexer cluster master is for), but what about non-clustered indexers (search peers)? Is it Best Practice to use the Deployment Server to deploy configurations to my non-clustered indexers or not?

Thanks in advance.

BlueSocket

[Jeremiah · Accepted solution]

Yes, for non-clustered search heads and indexers, use the deployment server to manage your configurations. You can also use a CM tool (like puppet or chef) if you are using them in your environment. We have used the deployment server to manage our non-clustered Splunk servers for several years.

However, you may want to consider clustering your indexers, even if you are not going to take advantage of data replication. This document discusses the pros and cons:

http://docs.splunk.com/Documentation/Splunk/6.3.2/Indexer/Clustersinscaledoutdeployments

[BlueSocket]

Thank you very much for the responses. The indexers are geographically diverse and I think that the replication might cause performance issues.

Thanks, anyway!

[jchampagne_splu]

Yes, if you're not using index clustering, it would be appropriate to use the Deployment Server to manage your configurations between two Indexers and a Search Head.